Security News > 2022 > April > Hackers exploiting VMware servers with public RCE exploit

A proof-of-concept exploit has been released online for the VMware CVE-2022-22954 remote code execution vulnerability, already being used in active attacks that infect servers with coin miners.

The vulnerability is a critical remote code execution impacting VMware Workspace ONE Access and VMware Identity Manager, two widely used software products.

The software vendor released a security advisory for the vulnerability on April 6, 2022, warning about the possibility of a threat actor with network access triggering a server-side template injection that results in RCE. VMware has released security updates for the affected products and workaround instructions to help address the risk for deployments that admins can't immediately update.

While releasing public exploits raises the risks that threat actors will exploit them in attacks, they are also meant to help secure systems through testing and serve as validators of existing fixes/patches.

Today, threat actors are actively scanning for vulnerable hosts, with cybersecurity intelligence firm Bad Packets telling BleepingComputer that they are detecting attempts to exploit the vulnerability in the wild.

Security researcher Daniel Card also shared on Twitter that the vulnerability was being exploited to drop coinminer payloads, commonly the first attacks we see when threat actors target a new vulnerability.

News URL

https://www.bleepingcomputer.com/news/security/hackers-exploiting-vmware-servers-with-public-rce-exploit/